CVE-2026-31431: Linux Kernel

What is CVE-2026-31431?

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS7.8 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS95% · P100

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD published2026-04-22

NVD last modified2026-07-15

Timeline

2026-04-22Published to the U.S. National Vulnerability Database (NVD)
2026-05-01First covered in a defend.network daily briefing
2026-05-01Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-05-15CISA federal remediation deadline (BOD 22-01)
2026-07-15NVD record last updated

CISA Known Exploited Vulnerability

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Added to KEV2026-05-01

Federal patch deadline2026-05-15

Known ransomware useUnknown

Affected product

Linux Kernel

NVD also lists CPE entries for: Suse Caas Platform, Suse Enterprise Storage, Suse Manager Proxy, Suse Manager Retail Branch Server, Suse Manager Server

Remediation Steps

Identify all Linux systems running vulnerable kernel versions across your infrastructure
Prioritize patching systems with local user access or multi-tenant configurations
Apply kernel security updates from distribution vendors (RHEL, Ubuntu, Debian, etc.)
Schedule reboot windows to activate patched kernels and verify successful application
Monitor for suspicious local privilege escalation attempts in system audit logs

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 1 of May 2026 (May 4 – 10)
Linux root vulnerability in KEV; cPanel mass-exploitation continues (2026-05-04)
PyTorch Lightning & SAP supply-chain; AI cuts attack time to 24h (2026-05-01)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.